- Introduction to Windows Intune
- Mobile Device Management Features
- Windows Intune Licensing and Supported Architectures
- The Windows Intune Connector and Subscription
This chapter is from the book
This chapter is from the book
This chapter is from the book
Mobile Device Management Features
With the December 2012 release of Windows Intune, the fourth release in less than 2 years, Microsoft shifted heavily into mobile device management. By integrating with Configuration Manager 2012 SP 1, organizations could now see mobile devices natively inside of the ConfigMgr console, and not just those devices discovered via the Exchange connector. The key features delivered in Configuration Manager are listed here, followed by an explanation of each feature:
- Device management
- Device inventory
- Policy settings management
- Application distribution
- Device retirement and remote wipe
For a detailed explanation of the use of the new features within ConfigMgr 2012 R2, see Chapter 8, “Mobile Device Management in Configuration Manager 2012 R2.”
Device Management
One of the exciting features supported within Intune is the ability to perform direct device management of modern smartphones such as Windows Phone 8 and iOS. This over-theair enrollment and management process no longer requires the need to use Exchange ActiveSync policies to manage settings on the devices.
The December 2012 release of Intune and the January 2013 release of ConfigMgr 2012 SP 1 accomplished mobile device management by leveraging a management channel that exists within the mobile OS, versus deploying a management agent (app) to the device to perform all the management functions. Therefore Intune did not support Android devices, and only supported Windows 8 RT (RTM). The Android operating system platform did not include the functionality of an embedded management channel to deliver the functionality wanted by Microsoft. For Android policy and settings management, Microsoft still required the use of Exchange ActiveSync (EAS). Configuration Manager administrators could still see Android devices within the console, however it required using the Exchange connector and the Android device must have Exchange ActiveSync configured.
With the release of Configuration Manager 2012 R2, a new version of Windows Intune, and the Windows 8.1 client OS, there are new options available to manage mobile devices. Android 4.x devices and Windows 8.1 (both x86 and ARM) can now be managed directly using the Intune management channel. To manage Android 4.x devices, users would install the new company portal application available for free in the Google Play Store, and enroll their device into Intune with this application. Windows 8.1 builds on the mobile management capabilities first added to Windows 8 RT. Using the embedded MDM agent, based on the Open Mobile Alliance–Device Management (OMA–DM) protocol, Windows 8.1 Intel x86-based machines can now be managed as mobile devices even though they are running a full Windows 8.1 OS. This is critical for Microsoft to expose since many BYOD scenarios include new full OS 8.1 devices. Without this option, companies would have to install the traditional ConfigMgr agent to manage the device. iOS and Windows Phone 8.x also added new enhancements to improve management functionality.
Device Inventory
Windows Intune supports gathering hardware inventory from the mobile device depending on mobile operating system support and settings defined within the ConfigMgr console. For devices that enrolled via Intune, Table A.1 identifies the attributes that are queried for and those devices that return the values.
TABLE A.1 Hardware Inventory Attributes from ConfigMgr R2 and Intune
Hardware Inventory Class |
WP8 |
Windows 8.1 |
iOS |
Android (Using the Company Portal App) |
Name |
✓ |
✓ |
✓ |
— |
Unique Device ID |
✓ |
✓ |
✓ |
— |
Serial Number |
— |
— |
✓ |
✓ |
Email Address |
✓ |
✓ |
✓ |
— |
Operating System Type |
✓ |
✓ |
— |
✓ |
Operating System Version |
✓ |
✓ |
✓ |
✓ |
Build Version |
— |
✓ |
— |
— |
Service Pack Major Version |
— |
✓ |
— |
— |
Service Pack Minor Version |
— |
✓ |
— |
— |
Operating System Language |
✓ |
— |
— |
— |
Total Storage Space |
— |
✓ |
✓ |
✓ |
Free Storage Space |
— |
✓ |
✓ |
✓ |
International Mobile Equipment Identity or IMEI (IMEI) |
— |
— |
✓ |
✓ |
Mobile Equipment Identifier (MEID) |
— |
— |
✓ |
— |
Manufacturer |
✓ |
✓ |
— |
✓ |
Model |
✓ |
✓ |
✓ |
✓ |
Phone Number |
— |
— |
✓ |
✓ |
Subscriber Carrier |
— |
— |
✓ |
✓ |
Cellular Technology |
— |
— |
✓ |
✓ |
Wi-Fi MAC |
— |
✓ |
✓ |
✓ |
For those devices managed using EAS, the attributes are first returned to Exchange, and then they are placed into the ConfigMgr database if the ConfigMgr Exchange connector is configured. Without installing the Exchange connector role in ConfigMgr, the information only resides within Exchange. Mobile devices that are managed using Windows Intune and EAS would have duplicate information returned to ConfigMgr. In those instances, ConfigMgr merges the two data records together into the device object.
Prior to ConfigMgr 2012 R2, mobile device software inventory was limited to the line-of-business (LOB) applications that were installed on the devices. ConfigMgr could then be used to query and report the users and devices that installed various LOB applications. Windows Intune did not support querying for all the installed software in the
ConfigMgr 2012 SP 1 release. Microsoft added support for full software device inventory in ConfigMgr 2012 R2 by adding a device setting that defines whether the device is company or personal owned. Any mobile device that the ConfigMgr administrator defined as “company-owned” reports full software inventory to the extent that the device platform supports it. Currently, only iOS and Android support a full software inventory, which is returned during the hardware inventory cycle timeframe.
Policy Settings Management
Microsoft’s vision of “people-centric IT” and unifying all device management inside of ConfigMgr is extremely attractive for organizations. A benefit of this approach is seen within mobile device policy settings. ConfigMgr administrators use similar skills and tasks for creating mobile device policies as for creating PC compliance items and baselines. Table A.2 enumerates the mobile device settings provided for unified device management in ConfigMgr 2012 R2.
Expect ConfigMgr to release mobile device features as rapidly as possible, as seen with the February 2014 release of new iOS 7 security and data-retention policies, the new Exchange email profile configuration capability, and the May 2014 Windows Phone 8.1 policies.
For the latest policy and feature support list, review http://technet.microsoft.com/en-us/library/dn376523.aspx. To support the release of MDM features without requiring large architecture changes and system upgrades, Configuration Manager R2 includes a new node under Cloud Services called Extensions for Windows Intune. Chapter 7 includes additional information on how to receive and enable new MDM feature updates.
Application Distribution and the Windows Intune Company Portal
Windows Intune application distribution for mobile devices is a user-friendly approach to self-service provisioning. In ConfigMgr 2012 R2, Windows Intune added additional application delivery options, building on the SP 1 features, which now support the following:
- Internal LOB apps written by the company.
- External public store applications. Also call deep links, these are shortcuts to applications that reside in the public marketplaces of the device platform, such as the Windows Phone Store or Apple App Store.
- Web links for users to access web-based applications.
- Device-targeted application “push” deployments.
TABLE A.2 ConfigMgr R2 Unified Device Management Policy Settings
Device Setting Group |
Settings |
Values |
Windows Phone 8.x |
Windows 8.1 Enrolled via Intune |
iOS |
Android (Using the Company Portal App) |
Browser |
Default browser |
Allowed /Prohibited |
Windows Phone 8.1 only |
— |
✓ |
— |
Browser |
Autofill |
Allowed /Prohibited |
— |
✓ |
✓ |
— |
Browser |
Plug-ins |
Allowed /Prohibited |
— |
✓ |
— |
— |
Browser |
Active scripting |
Allowed /Prohibited |
— |
✓ |
✓ |
— |
Browser |
Pop-ups |
Allowed /Prohibited |
— |
✓ |
✓ |
— |
Browser |
Fraud warning |
Allowed /Prohibited |
— |
✓ |
✓ |
— |
Browser |
Cookies |
Allowed /Prohibited |
— |
— |
✓ |
— |
Cloud |
Encrypted backup |
Allowed /Prohibited |
— |
— |
✓ |
— |
Cloud |
Document synchronization |
Allowed /Prohibited |
— |
— |
✓ |
— |
Cloud |
Photo synchronization |
Allowed /Prohibited |
— |
— |
✓ |
— |
Cloud |
Cloud backup |
Allowed /Prohibited |
— |
— |
✓ |
— |
Cloud |
Settings synchronization |
Allowed /Prohibited |
Windows Phone 8.1 only |
✓ (GET only) |
— |
— |
Cloud |
Credentials synchronization |
Allowed /Prohibited |
— |
✓ (GET only) |
— |
— |
Cloud |
Synchronization over metered connection |
Allowed /Prohibited |
— |
✓ (GET only) |
— |
— |
Cloud |
Microsoft Account |
Enabled /Disabled |
Windows Phone 8.1 only |
— |
— |
— |
Content Rating |
Adult content in media store |
Allowed /Prohibited |
— |
— |
✓ |
— |
Content Rating |
Ratings region |
Country of choice |
— |
— |
✓ |
— |
Content Rating |
Movie rating |
Rating |
— |
— |
✓ |
— |
Content Rating |
TV show rating |
Rating |
— |
— |
✓ |
— |
Content Rating |
App rating |
Rating |
— |
— |
✓ |
— |
Device |
Voice dialing |
Allowed /Prohibited |
— |
— |
✓ |
— |
Device |
Voice assistant |
Allowed /Prohibited |
— |
— |
✓ |
— |
Device |
Voice assistant while locked |
Allowed /Prohibited |
— |
— |
✓ |
— |
Device |
Screen capture |
Enabled /Disabled |
Windows Phone 8.1 only |
— |
✓ |
— |
Device |
Video conferencing |
Enabled /Disabled |
— |
— |
✓ |
— |
Device |
Add game center friends |
Allowed /Prohibited |
— |
— |
✓ |
— |
Device |
Multiplayer gaming |
Allowed /Prohibited |
— |
— |
✓ |
— |
Device |
Personal wallet software while locked |
Allowed /Prohibited |
— |
— |
✓ |
— |
Device |
Diagnostic data submission |
Enabled /Disabled |
Windows Phone 8.1 only |
✓ |
✓ |
— |
Device |
Geolocation |
Enabled /Disabled |
Windows Phone 8.1 only |
— |
— |
— |
Device |
Copy and Paste |
Enabled /Disabled |
Windows Phone 8.1 only |
— |
— |
— |
Encryption |
File encryption on mobile device |
On/Off |
✓ |
✓ (GET only) |
— |
✓, for Android 4 |
Internet Explorer |
Go to intranet site for single word entry |
Allowed /Prohibited |
— |
✓ |
— |
— |
Internet Explorer |
Always send Do Not Track header |
Allowed /Prohibited |
— |
✓ |
— |
— |
Internet Explorer |
Intranet security zone |
Allowed /Prohibited |
— |
✓ |
— |
— |
Internet Explorer |
Security level for Internet zone |
High, Medium-high, Medium |
— |
✓ (GET only) |
— |
— |
Internet Explorer |
Security level for intranet zone |
High, Medium-high, Medium, Medium-low, Low |
— |
✓ (GET only) |
— |
— |
Internet Explorer |
Security level for trusted sites zone |
High, Medium-high, Medium, Medium-low, Low |
— |
✓ (GET only) |
— |
— |
Internet Explorer |
Security level for restricted sites zone |
High |
— |
✓ (GET only) |
— |
— |
Internet Explorer |
Namespace exists for browser security zone |
Sites |
— |
✓ |
— |
— |
Password |
Require password settings on mobile devices |
Required |
✓ |
— |
✓ |
✓, for Android 4 |
Password |
Password complexity |
PIN, Strong |
✓ |
✓ |
✓ |
— |
Password |
Idle time before mobile device is locked (minutes) |
1 minute - 12 hours |
✓ |
✓ |
✓ |
✓, for Android 4 |
Password |
Minimum password length (characters) |
4–18 |
✓ |
✓ |
✓ |
✓, for Android 4 |
Password |
Number of passwords remembered |
0-50 |
✓ |
✓ |
✓ |
✓, for Android 4 |
Password |
Password expiration in days |
1-365 |
✓ |
✓ |
✓ |
✓, for Android 4 |
Password |
Number of failed logon attempts before device is wiped |
0-100 |
✓ |
✓ |
✓ |
✓, for Android 4 |
Password |
Password quality |
Low security biometric, Required, At least numeric, At least alphabetic, Alphanumeric with symbols |
— |
— |
— |
✓, for Android 4 |
Roaming |
Allow voice roaming |
Allowed /Prohibited |
— |
— |
✓ |
— |
Roaming |
Allow data roaming |
Allowed /Prohibited |
— |
✓ |
✓ |
— |
Security |
Removable storage |
Allowed /Prohibited |
✓ |
— |
— |
— |
Security |
Camera |
Allowed /Prohibited |
Windows Phone 8.1 only |
— |
✓ |
✓, for Android 4.1 |
Security |
Bluetooth |
Allowed /Prohibited |
Windows Phone 8.1 only |
✓ (GET only) |
— |
— |
Security |
Allow app installation |
Allowed /Prohibited |
— |
— |
✓ |
— |
Security |
Near field communication (NFC) |
Enabled /Disabled |
Windows Phone 8.1 only |
— |
— |
— |
Store |
Application store |
Allowed /Prohibited |
Windows Phone 8.1 only |
— |
✓ |
— |
Store |
Force application store password |
Enabled /Disabled |
— |
— |
✓, this setting applies to iTunes only |
— |
Store |
In-app purchases |
Allowed /Prohibited |
— |
— |
✓ |
— |
System Security |
User to accept untrusted TLS certificates |
Allowed /Prohibited |
— |
— |
✓ |
— |
System Security |
User access control |
Always notify, Notify app changes, Notify app changes (do not dim desktop), Never notify |
— |
✓ |
— |
— |
System Security |
Network firewall |
Required |
— |
✓ (GET only) |
— |
— |
System Security |
Updates |
Automatic updates is required |
— |
✓ |
— |
— |
System Security |
Virus protection |
Required |
— |
✓ (GET only) |
— |
— |
System Security |
Virus protection signatures are up-to-date |
Required |
— |
✓ (GET only) |
— |
— |
System Security |
SmartScreen |
Enabled /Disabled |
— |
✓ |
— |
— |
System Security |
Lock screen control center |
Enabled /Disabled |
— |
— |
✓ (iOS 7) |
— |
System Security |
Lock screen notification view |
Enabled /Disabled |
— |
— |
✓ (iOS 7) |
— |
System Security |
Lock screen today view |
Enabled /Disabled |
— |
— |
✓ (iOS 7) |
— |
System Security |
Fingerprint for unlocking |
Allowed /Prohibited |
— |
— |
✓ (iOS 7) |
— |
Data Protection |
Open managed documents in other unmanaged apps |
Allowed /Prohibited |
— |
— |
✓ (iOS 7) |
— |
Data Protection |
Open unmanaged documents in other managed apps |
Allowed /Prohibited |
— |
— |
✓ (iOS 7) |
— |
Windows Server Work Folders |
Work folders URL |
URL |
— |
✓ |
— |
— |
Email Management |
Custom Email account |
Enabled /Disabled |
Windows Phone 8.1 only |
— |
✓ (iOS 7) |
— |
Wireless Communication |
Wi-Fi Tethering |
Enabled /Disabled |
Windows Phone 8.1 only |
— |
— |
— |
Wireless Communication |
Offload data to Wi-Fi when possible |
Enabled /Disabled |
Windows Phone 8.1 only |
— |
— |
— |
Wireless |
Wi-Fi hotspot reporting Communication |
Enabled /Disabled |
Windows Phone 8.1 only |
— |
— |
— |
Wireless Communication |
Wireless network connection |
Enabled /Disabled |
Windows Phone 8.1 only |
— |
— |
— |
To install the available self-service applications, users leverage a company portal application on their mobile device. In ConfigMgr 2012 R2, Microsoft shows their commitment to a consistent user experience by releasing updated company portal applications for Windows Phone 8 and Windows 8.1, along with new company portal applications for iOS and Android that bring parity to functionality and appearance. However, the company portal is used for more than just application delivery; it is designed to allow a user to have control over their devices and is tailored to each device platform. In addition to accessing applications that were published to that user, the company portal is used to enroll iOS and Android devices, and even control aspects of other devices linked to that user account. The exact functionality in the Company Portal depends on the device platform. Table A.3 lists company portal features.
TABLE A.3 Company Portal Features
Action Taken |
Windows 8.1 |
Windows Phone 8.x |
iOS |
Android |
Enroll local device |
— |
— |
✓ |
✓ |
Rename devices |
✓ |
✓ |
✓ |
✓ |
Retire local device |
✓ |
✓ |
✓ |
✓ |
Wipe other devices remotely |
✓ |
✓ |
✓ |
✓ |
Install company line of business apps |
✓ |
✓ |
— |
✓ |
Install deep-linked apps from Public Stores |
✓ |
✓ |
✓ |
✓ |
Install or launch web-based application links |
✓ |
✓ |
✓ |
✓ |
Device Retirement and Remote Wipe
Windows Intune provides two distinct functions for a mobile device that is either lost/stolen or at end-of-life for management. Mobile devices can be retired from management, breaking the management channel where the device no longer receives management policies. Both administrators and users have the ability to perform this action, which could also be considered a “selective wipe” procedure, as it removes company applications, data, and management policies. Mobile devices can also be remotely wiped; for those devices that support that command, it is a factory reset of the device.